Many of our customers use SSH jumpboxes - its a natively supported feature of Okta Advanced Server Access / ScaleFT.
From a post awhile back about using Bastions with ScaleFT:
> One of our values at ScaleFT is to do our best to support our users where they are, with the decisions and tools they’ve already selected. This means treating SSH bastions as an SSH feature, parameterizing and centralizing the associated configurations, and seamlessly integrating it into our users’ daily workflows.
From a post awhile back about using Bastions with ScaleFT:
> One of our values at ScaleFT is to do our best to support our users where they are, with the decisions and tools they’ve already selected. This means treating SSH bastions as an SSH feature, parameterizing and centralizing the associated configurations, and seamlessly integrating it into our users’ daily workflows.
https://www.scaleft.com/blog/bastion-hopping-with-ssh-and-sc...
So, if you want to layer on top VPNs, or SSH Jump Boxes, we try to let you. We also try to make parts of the chain better whenever we can.
(disclaimer, I'm ScaleFT co-founder)